Security

• Email delivery: Amazon SES in AWS us-east-2. Every message Volanea sends goes out over SES.
• Application: Google Cloud Run in asia-south1 (Mumbai), with Memorystore for queues and caching.
• Database: MongoDB Atlas on AWS in ap-south-1 (Mumbai), encrypted at rest.
• Backups: nightly database backups to Google Cloud Storage.
• Payments: Dodo Payments is our merchant of record. Card details go to Dodo; they never reach Volanea.

All traffic to the website, dashboard and API is encrypted with TLS. Passwords are hashed. Each workspace has separate live and test keys, and a test key renders and logs mail without ever delivering it. Webhook deliveries are signed with HMAC-SHA256 and a timestamp, so your endpoint can reject forged or replayed requests. Workspace members have roles (owner, admin, editor, viewer), and changes such as renaming a workspace are recorded in an audit log.

Sending domains are verified with SPF, DKIM and DMARC before mail goes out from them. Hard bounces and spam complaints are suppressed automatically, so an address that rejected you once is never mailed again by accident. A reputation guard watches bounce and complaint rates and slows or pauses sending before a bad list damages your domain.

Mail arriving at an inbox is checked for SPF, DKIM, DMARC, spam and viruses, and scanned for phishing. Messages can be held for review instead of reaching an AI agent, and inbox content is always marked as untrusted data so an agent does not treat a stranger's email as instructions.

Volanea is not SOC 2 or ISO 27001 certified, and we don't offer dedicated IPs or a contractual SLA. If your procurement process requires those today, we'd rather tell you here than in week three of an evaluation.

Email support@volanea.com with “Security report” in the subject. We'll acknowledge within two business days and keep you updated until it's fixed. Please don't access other customers' data or degrade the service while testing.